Domain Reputation API Docs

Domain Reputation API

ASK AI

The WhoisFreaks Domain Reputation API is a real-time domain threat assessment service. Given any domain name, it returns a comprehensive risk verdict, trust score, DGA (Domain Generation Algorithm) analysis, threat intelligence matches, and actionable security signals, all in a single API call.

Authorization

You can make authorized requests to our API by passing API key as a query parameter. To get your API key, login to our billing dashboard and get your API key! If your API key has been compromised, you can change it by clicking on reset button in billing dashboard.

Important References

For details on request limits and handling rate limiting, refer here
For a complete overview of API credit consumption and usage, refer here

Query Parameters

Required

apiKey
Retrieve your API key from the billing dashboard.
domainName
The domain name to assess (e.g., `example.com`). Must contain at least one dot, max 253 characters. Automatically lowercased.

Request

SHELL

Loading request...

Response

Loading response...

Fields Description

Fields

Details

Example

input

Input object containing the analyzed domain

domain

Domain name being analyzed

example.com

assessed_at

Timestamp when the assessment was performed

2026-07-08T08:12:29Z

version

API/response schema version

1.0.0

processing_time_ms

Time taken to process the request, in milliseconds

742

risk_category

Overall risk assessment for the domain

verdict

Final verdict of the risk assessment

confidence

Confidence score for the verdict

0.94

primary_threat

Main threat type identified

phishing

severity

Severity level of the risk

threat_types

List of threat types associated with the domain

sources

Threat intelligence sources that flagged the domain

source

Name of the threat intelligence source

Spamhaus

indicator

Indicator matched by this source

example.com

threat_type

Threat type reported by this source

phishing

confidence

Confidence score from this source

0.97

first_seen

First time this indicator was seen by the source

2026-07-01T10:22:00Z

last_seen

Last time this indicator was seen by the source

2026-07-08T05:00:00Z

pivot_matches

Related pivots (NS, email, etc.) linked to known threats

pivot

Pivot value (e.g. nameserver or email)

ns1.exampledns.com

pivot_type

Type of pivot

total_related_threats

Total number of threats related to this pivot

34

confidence

Confidence score for the pivot match

0.92

dga_score

Domain Generation Algorithm (DGA) detection results

score

DGA likelihood score

0.81

is_dga

Indicates whether the domain is likely DGA-generated

true

model

Model used to compute the DGA score

deterministic_features_v1

features

Underlying lexical/statistical features used in DGA detection

domain_length

Length of the domain name

17

vowel_consonant_ratio

Ratio of vowels to consonants in the domain

0.18

ngram_perplexity

N-gram perplexity score of the domain string

3.91

shannon_entropy

Shannon entropy of the domain string

4.72

digit_letter_ratio

Ratio of digits to letters in the domain

0.23

consonant_streak_max

Maximum consecutive consonant streak in the domain

6

tld_in_known_dga_set

Indicates if the TLD belongs to a known DGA set

false

interpretation

Human-readable interpretation of the DGA score

trust_signals

Trust scoring and supporting signals for the domain

trust_score

Overall trust score

12

trust_band

Trust score band/category

signals

Signals contributing to the trust score

positive

Signals that positively affect trust score

code

Signal code identifier

valid_ssl

weight

Weight assigned to the signal

8

polarity

Polarity of the signal

positive

category

Category the signal belongs to

evidence

Evidence supporting the signal

Website did not respond

confidence

Confidence score for the signal

1.0

indicators

Individual trust/risk indicators for the domain

is_newly_registered

Indicates whether the domain was recently registered

true

uses_free_extension

Indicates whether the domain uses a free TLD extension

false

uses_free_ssl

Indicates whether the domain uses a free SSL certificate

true

has_privacy_whois

Indicates whether WHOIS privacy protection is enabled

true

ssl_age_days

Age of the SSL certificate in days

18

has_dmarc

Indicates whether a DMARC record exists

false

has_spf

Indicates whether an SPF record exists

true

redirects_externally

Indicates whether the domain redirects to an external site

true

javascript_obfuscated

Indicates whether obfuscated JavaScript was detected

true

domain_age_days

Age of the domain in days

24

registrar

Domain registrar name

Namecheap

email_deliverability

Assessment of the domain's ability to send and receive email reliably

score

Overall email deliverability score out of 100

95

grade

Letter/word grade summarizing the deliverability score

can_receive_email

Indicates whether the domain is configured to receive email

true

authentication

Email authentication mechanisms configured for the domain

spf

Sender Policy Framework configuration

present

Indicates whether an SPF record was found

true

policy

SPF enforcement policy qualifier found in the record

record

Raw SPF DNS TXT record string

v=spf1 include:_spf.example.com -all

dkim

DomainKeys Identified Mail configuration

found

Indicates whether a DKIM record was found for any probed selector

true

selectors_found

List of DKIM selectors for which a record was found

["google"]

providers_detected

Email service providers inferred from the matched DKIM selectors

["Google Workspace / Gmail"]

note

Clarifying note about the limitations of DKIM selector probing

Only common selectors are probed; a domain may use a custom selector

dmarc

Domain-based Message Authentication, Reporting and Conformance configuration

present

Indicates whether a DMARC record was found

true

policy

DMARC enforcement policy applied to failing messages

reject

reporting_configured

Indicates whether DMARC aggregate/forensic reporting addresses are configured

true

infrastructure

Mail server infrastructure backing the domain

mx_count

Number of MX records found for the domain

2

mx_records

List of mail exchange server hostnames for the domain

["aspmx.l.google.com", "alt1.aspmx.l.google.com"]

mx_provider

Email hosting provider inferred from the MX records

google_workspace

null_mx

Indicates whether the domain explicitly declines email via a null MX record

false

reputation

Reputation and trust signals related to the domain's email sending history

spam_blacklisted

Indicates whether the domain appears on known spam blacklists

false

newly_registered

Indicates whether the domain was registered recently

false

domain_age_days

Age of the domain in days since registration

10500

issues

List of detected email deliverability issues or misconfigurations

code

Machine-readable code identifying the specific deliverability issue

severity

Severity level assigned to the detected issue

intelligence

Threat intelligence details for the indicator of compromise (IOC)

ioc_type

Type of the indicator of compromise

ioc_value

Value of the indicator of compromise

example.com

related_iocs

Other IOCs related to this domain

type

Type of the related IOC

ipv4

value

Value of the related IOC

93.184.216.34

confidence

Confidence score for the related IOC

0.91

feed_tags

Tags associated with this IOC from threat feeds

["verdict:suspicious", "severity:high", "campaign:phishing"]

stix_pattern

STIX pattern representation of the IOC

[domain-name:value='example.com']

recommended_action

Recommended action based on the assessment

block

first_seen

First time this IOC was observed

2026-07-01T10:22:00Z

last_seen

Last time this IOC was observed

2026-07-08T05:00:00Z

evidence_summary

Summary of reasons behind the risk assessment

why_flagged

List of reasons why the domain was flagged

["Detected in multiple phishing feeds", "Newly registered domain"]

errors

List of errors encountered during processing, if any

["WHOIS lookup failed", "DNS lookup timed out"]

Domain Reputation API Documentation